PHP Stale Internal Request-State Vulnerability (CVE-2026-109619)

Catalog analysis: CISA added this entry on October 26, 2026. The entry reflects catalog information retrieved on October 27, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-109619 is a stale internal request-state vulnerability identified in PHP. The flaw enables an unauthenticated attacker to achieve remote code execution (RCE). This vulnerability is associated with several Common Weakness Enumerations, including CWE-416 (Use After Free), CWE-755 (Improper Handling of Exceptional Conditions), CWE-824 (Incorrect Calculation of Buffer Size), CWE-1325, and CWE-1419.

Exposure and applicability

This vulnerability affects the PHP engine. Because PHP is a foundational open-source component used across a vast array of web applications, servers, and third-party libraries, exposure is widespread. The risk is highest for assets that are internet-facing and running unpatched versions of PHP.

Due to its inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog on October 26, 2026, this flaw is confirmed to be exploited in the wild. This elevates the priority for vulnerability management teams to identify all instances of PHP within their environment, regardless of whether they are deployed as standalone servers or embedded within other software products.

Remediation priorities

Our analysis suggests prioritizing remediation based on asset exposure and the criticality of the hosted application. The following actions are recommended:

1. Immediate Asset Identification: Inventory all systems running PHP. Priority should be given to internet-facing assets, as these provide the most direct path for unauthenticated RCE.
2. Vendor Mitigation Application: Apply updates and mitigations according to the official instructions provided by the PHP Group.
3. Forensic Triage: Because this vulnerability is known to be exploited and CISA has flagged it for forensic triage, defenders should examine logs and system state for indicators of compromise on affected assets before and after patching.
4. Cloud Service Review: For organizations utilizing managed cloud services, verify the patch status with the service provider to ensure the underlying PHP runtime has been updated.

How to validate remediation

Verification must go beyond confirming a version number change. To assure that exposure has been reduced, defenders should employ the following methods:

• Configuration Audit: Verify that the applied mitigation is active in the running environment and not just present in the installed binaries.
• Runtime Validation: Use authorized security scanning or internal testing to confirm that the specific request-state conditions leading to the vulnerability are no longer exploitable.
• Log Analysis: Monitor for continued attempts to trigger the flaw, which can help identify remaining unpatched assets that were missed during the initial inventory.

Limits and open questions

While patching reduces the likelihood of exploitation, residual risk remains if the environment contains third-party extensions or proprietary implementations of PHP that may interact unpredictably with the fix.

It remains unknown whether specific ransomware campaigns are currently leveraging this vulnerability. Additionally, because PHP is often embedded in other products, some organizations may be unable to patch the component directly and must wait for a vendor-supplied update for the parent application.

Source and editorial note

CVE-2026-109619: PHP Stale Internal Request-State Vulnerability · Source date: October 26, 2026 · Retrieved October 27, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment